How can I locate a rogue access point?

[sidewinder]

Last few days Ive noticed that as well as our normal network appearing, we have also had one called just '3com'

 

Since we dont use any 3com equipment I can only assume someone has either brought in an access point or are running a network from their laptop or something

 

Ive used Netstumbler and can find out how strong the signal is and what the MAC address is but how do I get any further? I could walk around the entire building with the laptop and see when the signal gets stronger but theres still a chance I could not find it (not to mention ill look like an idiot)

 

There has been DHCP address issued to that MAC, thats about all I could check. Where do I go from here?

[plexer]

Does it dish ip addresses from it?

 

If so and yuo can connect to it if it is open then type in the dhcp server address probably 192.168.1.1 into internet explorer and naviagte to the router setup.

 

You may find you are just picking up someones home 3com we have that here.

 

Their username is usually their email address so you could email them.

 

Ben

[sidewinder]

That is a good point, I never actually connected to it, may have been an idea being it was unsecured

 

Bloody thing has dissapeared now though so cant try

 

I think its unlikely to be someones home one, as Im bang in the centre of the site in an old concrete building and theres no houses for a good distance around me

[Mr_T]

That is a good point, I never actually connected to it, may have been an idea being it was unsecured

 

Bloody thing has dissapeared now though so cant try

 

I think its unlikely to be someones home one, as Im bang in the centre of the site in an old concrete building and theres no houses for a good distance around me

 

Is it possible it was an ad hoc network setup on one of the staffs lappy?

[sidewinder]

I think it probably is as it appeared again earlier and I couldnt connect to it

 

Ive got my suspicions who it is, a certain teacher who likes 'tinkering' and insists on bringing in his own standalone laptop, which could explain the 3com SSID (as all of our staff laptops have Intel cards)

[pete]

Airmagnet tools are pretty handy (expensive though) and have demo versions:

 

http://www.airmagnet.com/products/laptop.htm

[Ric_]

It's times like this you need to have a clever wireless system (like my BlueSocket one) which will 'contain' rogue APs... you soon find out where they are when people cannot connect to them anymore